GHSA-qqxc-cppg-4xp8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-qqxc-cppg-4xp8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qqxc-cppg-4xp8/GHSA-qqxc-cppg-4xp8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-qqxc-cppg-4xp8
- Aliases
- Published
- 2022-05-17T03:57:06Z
- Modified
- 2024-04-23T18:11:44.264481Z
- Severity
-
- 6.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Drupal Reflected file download vulnerability
- Details
-
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
- Database specific
{ "nvd_published_at": "2016-04-12T15:59:00Z", "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-04-23T17:19:29Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2016-3168
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-3168.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-3168.yaml
- https://github.com/drupal/core
- https://www.drupal.org/SA-CORE-2016-001
- http://www.debian.org/security/2016/dsa-3498
- http://www.openwall.com/lists/oss-security/2016/02/24/19
- http://www.openwall.com/lists/oss-security/2016/03/15/10
Affected packages
Packagist / drupal/core
Package
- Name
- drupal/core
- Purl
- pkg:composer/drupal/core
Packagist / drupal/core
Package
- Name
- drupal/core
- Purl
- pkg:composer/drupal/core
Packagist / drupal/drupal
Package
- Name
- drupal/drupal
- Purl
- pkg:composer/drupal/drupal
Packagist / drupal/drupal
Package
- Name
- drupal/drupal
- Purl
- pkg:composer/drupal/drupal